Hi Lior, here's a thread with a similar problem: Capture bandwidth of each unique url. I think the solution that Christian proposes is the best one: extract the URL you want at indexing time (for example, using Logstash's grok filter) and store it as a separate field mapped as a keyword.
Thanks,
CJ